JP4245486B2 - Network unauthorized connection prevention method and apparatus - Google Patents

Description

  The present invention relates to a network unauthorized connection prevention method and apparatus, and more particularly to a network unauthorized connection prevention method and apparatus for a terminal in a LAN (closed network) composed of a plurality of routers and hubs.

Conventionally, when a terminal is erroneously connected or illegally connected (malicious connection) in a LAN, the following preventive measures have been implemented by network devices.
(1) There is a conventional technology that does not permit connection by a network device for terminals other than the IP address or MAC address of a terminal that has been permitted in advance (terminals that are not permitted).

In this example, permission to connect to all ports is set by the IP address of the terminal, and the source IP address of the received Address Resolution Protocol (ARP) frame and the IP address of the terminal that has permission to connect to the port are set. If they match, there is a hub with an intrusion prevention function in which the port whose source MAC address of the last received frame is the source MAC address of the ARP frame cannot be used (for example, see Patent Document 1).
(2) When connecting an external network and a LAN, a database is set up in the relay device (firewall, router) to constantly monitor incoming packets and detect illegal packets from the contents of received packets. In addition, there is a conventional technique in which measures for preventing intrusion of illegal packets are taken (for example, see Patent Document 2).
Japanese Patent Laid-Open No. 11-177597 (Abstract, Fig. 1) JP 2002-73433 A (Abstract, Fig. 1)

  In the case of the above prior art (1), it is assumed that the intrusion prevention function is installed in the hub as a relay device. If there is no hub with this function in the currently operating intranetwork, all hubs It is necessary to implement the intrusion prevention function. In addition, even when the network configuration is changed, there is a problem that equipment costs and introduction man-hours increase because the equipment of all hubs is changed.

  Also, in this case, when an unauthorized port is detected, the port cannot be used. If the port is connected to another hub in the cascade, it is connected to the other hub. There was a problem that even legitimate terminals could not communicate.

  Furthermore, in the case of the above-mentioned prior art (2), an unauthorized connection monitoring function is implemented in a device (firewall or router) that relays between the Internet (external network) and the LAN, thereby preventing unauthorized connection without relaying unauthorized packets. There is a problem that unauthorized connection cannot be prevented in closed communication within a LAN.

  SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a network unauthorized connection prevention method and apparatus that is inexpensive and requires less man-hours in closed area communication within a LAN.

Network unauthorized access preventing method according to the present invention for achieving the above object, first determines whether the specific information of the terminal contained in the ARP request received via a LAN from the terminal is already registered Step, and when it is determined that the terminal is unregistered in the first step, the terminal considers the terminal as an unauthorized terminal, and sets an address of the terminal regarded as the unauthorized terminal as a source address and a destination address. A second step of transmitting a reply and a disturbing ARP request in which the address of the terminal regarded as the unauthorized terminal is set as a transmission source address and a transmission destination address .

That is, in the first step, when the specific information from a terminal connected to the LAN is received as an ARP request, determines whether the specific information matches the information registered in advance. In the second step, the disturbing ARP request and the disturbing ARP reply are transmitted by assuming that the terminal that has been unregistered in the first step is an unauthorized terminal.

These disturbances ARP request and interference ARP reply, since shows that the unique information of the terminal exists in duplication, unauthorized terminal 12 that has received the interference ARP request and interference ARP reply these in, so know that your specific information is duplicated, there, it would stop the communication, it is possible to prevent unauthorized access.

  In this way, according to the present invention, nodes in the LAN can be connected to the network, so that it is possible to reduce network equipment costs and work man-hours associated with changes.

  In addition, it is possible to prevent only unauthorized connection terminals from interfering with communication and prevent other legitimate connection terminals from being affected.

  Furthermore, it is possible to prevent unauthorized connection in closed communication within a LAN.

  The above ARP request is, for example, an ARP request transmitted at the time of connection to the network. As a preventive measure in case of escaping this request, the ARP request when the unauthorized terminal requests an address from another terminal is used. Interference with unauthorized connection terminal communication may be performed.

In the second step, the disturbing ARP reply and the ARP request may be repeatedly transmitted a predetermined number of times at regular time intervals. Thereby unauthorized terminal becomes possible to know with certainty that his specific information is duplicated, it is possible to reliably prevent the communication of unauthorized connection terminals.

Whether the network unauthorized access preventing apparatus of the present invention to realize a network unauthorized access preventing method according to the invention described above, specific information of the terminal contained in the ARP request received via a LAN from the terminal is already registered A first means for determining whether the terminal is an unauthorized terminal when the first means determines that it is unregistered, and the address of the terminal regarded as the unauthorized terminal is a source address and a destination A disturbing ARP reply set as an address, and a second means for transmitting a disturbing ARP request in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address . .

  In the network unauthorized connection preventing apparatus described above, an ARP request transmitted at the time of network connection or an ARP request when the unauthorized terminal requests private information from another terminal can be used as the ARP request.

The second means may include means for repeatedly transmitting the disturbing ARP reply and ARP request a predetermined number of times at regular time intervals.

The specific information of the similar to the method of the present invention, it is possible to use the MAC address or IP address.

Further, in the present invention, the unique information of the terminal is registered from the first means for sequentially transmitting the ARP request to each registered terminal and the ARP reply returned in response to the ARP request. A second means for determining whether or not the terminal is regarded as an unauthorized terminal when the second means determines that it is unregistered, and the address of the terminal regarded as the unauthorized terminal is a source address and A third means for transmitting a disturbing ARP reply set as a destination address and a disturbing ARP request set with the address of the terminal regarded as the unauthorized terminal as a source address and a destination address ; An apparatus for preventing unauthorized network connection is provided.

A VLAN tag can be attached to the above-described jamming ARP reply and jamming ARP request .

  As described above, according to the network unauthorized connection prevention method and apparatus according to the present invention, the unauthorized connection prevention in the LAN is suppressed, and can be implemented in a device connected as one node (PC level) in the intra network. In addition, since it is not necessary to mount it on a hub, firewall, or router that is currently in operation, costs can be reduced without affecting the existing network.

  Furthermore, since the present invention does not depend on the LAN configuration (physical configuration, logical configuration), if a LAN configuration change occurs, unauthorized connection can be prevented by changing the settings of the present invention alone, and LAN operation management The burden on the person can be reduced.

  Furthermore, when a cascade connection is made as in the prior art, the legitimate terminal does not become incapable of communication, and only the illegally connected terminal can be blocked.

  Furthermore, in the present invention, even in a network environment using VLAN, it is possible to search for unauthorized connection terminals set with addresses that cannot be used in the corresponding segment or to block communication, and moreover, it is possible to control multiple segments with one device of the present invention. It becomes.

  Further, in the present invention, even in a network operation in which the IP address and the MAC address dynamically change in a DHCP (Dynamic Host Configuration Protocol) environment, when the unauthorized connection is detected only by the MAC address, the present invention can be applied to the DHCP environment. .

  FIG. 1 shows an example of a system configuration used in a network unauthorized connection prevention method and apparatus according to the present invention, and FIG. 1 (1) particularly shows regular terminals 10 and 11 and network unauthorized connection prevention apparatus 20 in a LAN 100. 2 shows a system configuration example in which only the unauthorized terminal 12 is connected instead of the regular terminal 10. In the figure, the ARP request is indicated by RQ˜, and the ARP reply is indicated by RP˜.

  FIG. 2 shows a system configuration example of a VLAN environment in which the network unauthorized connection preventing apparatus 20 according to the present invention is connected to the segment A and the segment B configuring the VLAN 110 via the hub 30.

  FIG. 3 shows an embodiment of an apparatus for realizing the network unauthorized connection prevention method according to the present invention shown in FIG. 1 and FIG.

  In this embodiment, the network unauthorized connection prevention device 20 includes an interface control with the LAN 100 and a network interface unit 21 for analyzing or giving a tag (VLAN tag), an ARP processing unit 22 for analyzing and generating an ARP frame, When the unauthorized connection determination unit 23 searches for or detects a match / mismatch between the terminal unique information such as the address from the connected terminal and the information in the address information database unit 24, and the unauthorized connection determination unit 23 determines that the connection is unauthorized. A jamming processing unit 25 for instructing transmission of a jamming message and a search request processing unit 26 for instructing transmission of a message for searching for an illegally connected terminal existing in the network.

  Furthermore, the network interface unit 21 includes a VLAN tag analysis unit 211 and a VLAN tag assignment unit 212, and the ARP processing unit 22 includes an ARP reception unit 221 and an ARP transmission unit 222. The connection determination unit 23 includes a fraud detection unit 231, the interference processing unit 25 includes an interference control unit 251, a reception address buffer 252 and a timer control unit 253, and the search request processing unit 26 includes a search control unit. 261 and a timer processing unit 262.

The operation of the embodiment of the apparatus for realizing the network unauthorized connection prevention method according to the present invention shown in FIG. 3 will be described below with reference to FIGS.
Example (1): FIGS. 4-6
First, FIG. 4 (1) shows a sequence example when the regular terminals 10 and 11 and the network unauthorized connection prevention device 20 are connected to the LAN 100 as shown in FIG. 1 (1).

  In this sequence example, when the legitimate terminal 10 is connected to the LAN 100, the legitimate ARP requesting the MAC address, which is also the private information, of the legitimate terminal 10, in order to confirm the duplication of the IP address that is the private information. Request RQ1 is transmitted by broadcast (step S1). Since the legitimate terminal 11 is not an ARP request addressed to itself, no response is returned (step S2).

  On the other hand, at the same time, the regular ARP request RQ1 is also sent by broadcast in the network unauthorized connection prevention device 20, so in the network unauthorized connection prevention device 20, in the network interface unit 21, as shown in the flowchart of FIG. The packet is received (step S401), and the VLAN tag analysis unit 211 analyzes the VLAN tag information (step S402).

  Note that the VLAN tag analysis in step S402 is not particularly used in this embodiment (1) and is used in the embodiment (3) described later, as shown by the dotted line. Without mentioning, it will be described in Example (3).

  Thereafter, the ARP processing unit 22 is activated, and the ARP receiving unit 221 determines whether or not the frame is an ARP frame (step S411), and extracts and analyzes source / destination address information (MAC address, IP address). Is performed (step S412). When it is determined in step S411 that the received packet is not an ARP frame, the received packet is ignored and the process returns to step S401. However, when it is determined that the received packet is an ARP frame, the ARP processing unit 22 extracts the address extracted in step S412. The unauthorized connection determination unit 23 is activated using the information as input information, and the unauthorized connection determination unit 23 uses the unauthorized detection unit 231 therein, and the input address information is registered in the address information database unit 24 in advance by the network administrator. It is determined whether or not it exists in the address information (steps S421 and S422).

  As a result of the determination process in step S422, the input address information exists in the address information database unit 24 in this example, so the terminal 10 is regarded as a normal connection, and the regular ARP request RQ1 is ignored (step S3). Thus, the authorized terminal 10 becomes communicable, and the flowchart of FIG. 5 returns from step S422 to step S401 to enter the packet reception state.

  On the other hand, as shown in FIG. 1 (2), when the unauthorized terminal 12 is connected to the LAN 100, the sequence shown in FIG. 4 (2) is executed.

  First, the unauthorized terminal 12 transmits a regular ARP request RQ2 as in FIG. 4 (1), and IP address duplication is confirmed (step S11). The frame format of the regular ARP request RQ2 at this time is shown in FIG. As shown in the figure, in the regular ARP request RQ2 of the unauthorized terminal 10, type = “806” (hexadecimal number) indicates an ARP frame, and option code = “01” indicates an ARP request.

  In such an ARP request RQ2, the MAC address of the unauthorized terminal 10 is set in the source MAC address information area D1101, the IP address of the unauthorized terminal 10 is set in the source IP address information area D1102, and the destination MAC address The address is not set in the information area D1103 because it is broadcast, and the IP address of the unauthorized terminal 10 is set and transmitted in the transmission destination IP address information area D1104.

  Since the regular terminal 11 is not an ARP request addressed to itself, no response is returned (step S12). The network unauthorized connection prevention device 20 that receives the regular ARP request RQ2 at the same time performs unauthorized detection (step S13).

  That is, the network unauthorized connection prevention device 20 executes steps S401 to S422 shown in FIG. 5 so that the unauthorized detection unit 231 in the unauthorized connection determination unit 23 stores the input address information in the address information database unit 24. It detects that it does not exist, regards the terminal 12 as an unauthorized connection, and activates the disturbance control unit 251 of the disturbance processing unit 25.

  The disturbance control unit 251 determines that the network is connected because the transmission source IP address information area D1102 and the transmission destination IP address information area D1104 in the regular ARP request RQ2 shown in FIG. 6 are the same (step S431).

  As a result, the jamming control unit 211 inputs the address information of the unauthorized terminal 12, and sends a jamming ARP reply and a jamming ARP request transmission request to the ARP transmission unit 222 of the ARP processing unit 22 (step S432).

  The ARP transmission unit 222 of the ARP processing unit 22 sets its own MAC address, that is, the MAC address of the network unauthorized connection prevention device 20 in the source MAC address information area D1105, as shown in the disturbing ARP reply RP1 of FIG. The IP address of the unauthorized terminal 12 is set in the source IP address information area D1106, the MAC address of the unauthorized terminal 12 is set in the destination MAC address information area D1107, and the unauthorized terminal 12 is set in the destination IP address information area D1108. An ARP message with the IP address set (step S441) is generated (step S441) and transmitted (steps S452 and S14). In FIG. 5, VLAN tagging is also performed here as step S451, which will also be described in Example (3).

  Further, in order to transmit the disturbing ARP request RQ3 shown in FIG. 6 in the network unauthorized connection prevention device 20, the MAC address of the network unauthorized connection prevention device 20 is set in the source MAC address information area D1109, and the source IP address information An ARP message in which the IP address of the unauthorized terminal 12 is set in the area D1110 and the IP address of the unauthorized terminal 12 is set in the transmission destination IP address information area D1112 is generated and transmitted (steps S441, S452, and S15).

  As a result, since the unauthorized terminal 12 is informed that the IP address is duplicated, the communication is stopped.

In addition, when the regular ARP request RQ4 is transmitted from the unauthorized terminal 12 again (step S16), the IP address is not duplicated in the regular terminal 11, but is ignored (step S17). In the unauthorized connection prevention device 20, unauthorized detection is performed (step S18), and the disturbing ARP reply RP2 is transmitted in the same manner as described above (step S19), and together with this, the disturbing ARP request RQ5 is transmitted (step S20), The unauthorized terminal 12 appears to be completely blocked due to duplication of the IP address, and it is determined that communication is impossible (step S21).
Example (2): FIG. 7, FIG. 8, FIG.
This embodiment (2) performs fraud detection and interference during communication from a fraudulent terminal to a legitimate terminal, and the system configuration corresponds to that shown in FIG. 1 (2).

  First, Fig. 7 (1) shows an example of a sequence at the time of normal connection between terminals. When the regular terminal 10 starts communication with the regular terminal 11, the regular terminal 10 sends a regular ARP request RQ11. To request the MAC address of the authorized terminal (step S31).

  The regular terminal 11 that has received the regular ARP request RQ11 returns a regular ARP reply RP11 storing its own MAC address to the regular terminal 10 (step S33), so that IP communication from the regular terminal 10 to the regular terminal 11 ( 1) (Step S34) becomes possible. Note that in the network unauthorized connection prevention device 20 that has received the regular ARP request RQ11 at the same time as the regular terminal 11, when it is normal, it can be seen that it is not an unauthorized address in step S422 by executing steps S401 to S422 in FIG. The regular ARP request RQ11 is ignored (step S32).

  Further, in order to realize IP communication (2) to the regular terminal 10, the regular terminal 11 transmits a regular ARP request RQ12 (step S35), thereby requesting the regular ARP from the regular terminal 10 after requesting the MAC address of the regular terminal 10. By receiving the reply RP12 (step S37), the authorized terminal 11 acquires the MAC address of the authorized terminal 10, so that bidirectional IP communication (1) and (2) is established.

  The regular ARP request RQ12 transmitted in step S35 is also received by the network unauthorized connection prevention device 20, but is ignored in the same manner as described above (step S36).

  On the other hand, as shown in FIG. 7 (2), when the unauthorized terminal 12 is connected to the LAN 100 instead of the authorized terminal 10, when the unauthorized terminal 12 starts communication with the authorized terminal 11, the unauthorized terminal 12 The MAC address of the authorized terminal 11 is requested by transmitting the authorized ARP request RQ13 shown in FIG. 8 (step S41). The legitimate terminal 11 that has received the legitimate ARP request RQ13 transmits the legitimate ARP reply RP13 storing its own MAC address to the fraudulent terminal 12 (step S43), whereby IP communication from the fraudulent terminal 12 to the legitimate terminal 11 (1 ) Is possible (step S44).

  The authorized terminal 11 requests the MAC address of the unauthorized terminal 12 by sending an authorized ARP request RQ14 (step S45) in order to realize IP communication (2) to the unauthorized terminal 12, and in response to this, By sending the regular ARP reply RP14 from the unauthorized terminal 12 (step S47), the authorized terminal 11 obtains the MAC address of the unauthorized terminal 12, and bidirectional IP communication (1) and (2) is established. (Steps S44, S48).

  On the other hand, the network unauthorized connection prevention device 20 that has received the regular ARP request RQ13 by broadcast exists in the address information database unit 24 in which the input address information is registered in advance by the network administrator by the unauthorized connection unit 231 in the unauthorized connection determination unit 23. (Step S422 in FIG. 5), and as a result, if the input address information does not exist in the address information database unit 24, it is regarded as an unauthorized connection (step S42), the address information is input, The disturbance control unit 251 in the disturbance processing unit 25 is activated. When the regular ARP request RQ14 is received, the network unauthorized connection prevention device 20 is ignored because it is known to be a regular terminal (step S46).

  In the jamming control unit 251, after the source address information is stored in the reception address buffer 252, the source address information is compared with the destination address information. The communication is determined (step S431).

  Recognizing the unauthorized connection, the disturbance control unit 251 receives the address information and activates the ARP transmission unit 222 in the ARP processing unit 22. The ARP transmitter 222 edits the disturbing ARP request as an ARP message based on the input information.

  That is, the ARP transmitter 222 intentionally sets the MAC address of the network unauthorized connection prevention device 20 in the source MAC address information area D1205 in the ARP request, and the IP address of the unauthorized terminal 12 in the source IP address information area D1206. Is set, the IP address of the unauthorized terminal 12 is set in the destination IP address information area D1208, and the disturbing ARP request RQ15 shown in FIG. 8 is transmitted (step S49).

  The unauthorized terminal 12 that received the disturbing ARP request RQ15 recognizes that the IP address used by itself is used by the network unauthorized connection prevention device 20 and therefore the IP address is duplicated. It is possible to block IP communication (3) (step S50) to the terminal 11.

  Also, after the unauthorized terminal 12 receives the disturbing ARP request RQ15, the IP packet (step S50) addressed to the authorized terminal 11 flows toward the network unauthorized connection prevention device 20 (step S51), so that communication cannot be established. become. At this time, the network unauthorized connection prevention device 20 ignores the IP communication (3) from the regular terminal 11 (step S52).

  The network unauthorized connection prevention device 20 shows that it takes time from when an unauthorized detection is detected (step S42) until the jamming ARP request RQ15 is transmitted (step S49). Will do.

  In addition, in the unlikely event that a loss occurs on the network and communication from the unauthorized terminal 12 to the authorized terminal 11 cannot be interrupted, after sending the first disturbing ARP request RQ15, The timer control unit 253 performs transmission requests for the disturbing ARP requests RQ16 to RQ18 via the jamming control unit 25 three times at regular intervals with respect to the address information written in the reception address buffer 252 in this example. The communication is interrupted (steps S53, S57, S61).

  When the timer expires (step S434), the timer control unit 253 cancels the transmission of the disturbing ARP message to the unauthorized terminal 12 by releasing the corresponding address information written in the reception address buffer 252.

Also, when a disturbing ARP request is received, it appears that the unauthorized terminal 12 is temporarily blocked, but after a while, an IP packet can be transmitted (step S65). It is preferable to send RQ18. The IP communication (3) (steps S54, S58, S62) from the unauthorized terminal 12 is ignored for each of these disturbing ARP requests (steps S56, S60, S64).
Example (3): FIGS. 9 to 11
This embodiment (3) shows an embodiment in which the unauthorized terminal existing in the network is searched from the unauthorized network connection preventing apparatus 20.

  First, in this embodiment, the network unauthorized connection prevention device 20 activates the search control unit 261 when the timer processing unit 262 in the search request processing unit 26 expires (step S501 in FIG. 10). The search control unit 261 issues an ARP transmission destination address database search instruction to the address information database unit 24 in order to search the IP addresses of all terminals (step S502).

  As a result, when the ARP destination address is found, the search request processing unit 26 instructs the ARP transmission unit 222 to send an ARP request transmission request (steps S503 and S504), and based on the input information from the search control unit 261, A message (ARP request) is generated (step S511).

  As shown in the regular ARP request RQ21 in FIG. 11, the message content at this time is set the MAC address of the network unauthorized connection prevention device 20 in the source MAC address information area D1301, and the network illegal in the source IP address information area D1302. Set the IP address of the connection prevention device 20, and set the IP address of the terminal (IP address of the regular terminal 11 in the example shown) found in the destination IP address information area D1304 by the ARP destination address database search (step S502) Is done.

  Then, the ARP transmitter 222 transmits the normal ARP request RQ21 to the LAN 100 in response to a search ARP request transmission instruction (step S522) from the network interface unit 21 (step S522).

  In this way, when the regular ARP request RQ21 (step S71 in FIG. 9) transmitted from the network unauthorized connection prevention device 20 is a regular ARP request addressed to the regular terminal 11, the regular terminal 11 connects the regular ARP reply RP21 to the network illegally. Return to the prevention device 20 (step S72). As shown in FIG. 11, the message content of this regular ARP reply RP21 indicates that the type = “806” is an ARP frame, the option code = “02” is set to be an ARP reply, The MAC address of the legitimate terminal 11 is set in the source MAC address information area D1305, the IP address of the legitimate terminal 11 is set in the source IP address information area D1306, and the network unauthorized connection prevention device 20 is set in the destination IP address information area D1307. MAC address is set, and the IP address of the network unauthorized connection prevention device 20 is set in the destination IP address information area D1308.

  When the network unauthorized connection preventing apparatus 20 receives the regular ARP reply RP21, it is determined that the network unauthorized connection preventing apparatus 20 is not unauthorized by step S422 in FIG. 5 as described above (step S74).

  Further, the next ARP destination address search is resumed by an ARP destination address database search instruction (step S502) from the search request processing unit 26. Subsequent control methods are executed in the same manner as described above. In the example of FIG. 9, a regular ARP request is transmitted to the regular ARP request RQ24 and all other IP addresses (step S84). In the illustrated example, the terminals 11 and 10 do not respond (steps S82 and S83).

  When the ARP request destination database search instruction (step S502) finishes sending ARP requests to the IP addresses of all terminals (step S85), the whole process ends (step S503), and the unauthorized terminal search flow ends. At this time, the timer processing unit 262 is reset, and when the timer expires, the unauthorized terminal search flow is started again (step S86), and the authorized ARP request RQ21 addressed to the authorized terminal 11 is transmitted again from the unauthorized network connection preventing device 20 ( In step S87), the regular terminal 11 returns the regular ARP reply RP21 in the same manner as described above (step S88).

  On the other hand, if the network unauthorized connection prevention device 20 receives the regular ARP reply RP21 and then sends a regular ARP request RQ22 addressed to the unauthorized terminal 12 as shown in the figure (step S75), the unauthorized terminal 11 sends the authorized ARP reply RP22. As a result of the reception (step S77), as described above, when it is determined to be illegal in step S422 of FIG. 5 (step S78), the disturbing ARP request RQ23 is transmitted (step S79). This disturbing ARP request RQ23 is the same as the disturbing ARP requests RQ15 to RQ18 shown in FIG. 8. By transmitting this to the unauthorized terminal 12, the IP address is duplicated in the unauthorized terminal 12, causing communication interference. enable.

In the same way as above, when a disturbing ARP request is received, it seems to be temporarily blocked, but after a while the IP packet can be sent (step S80), so in this embodiment also the disturbing ARP request is repeated by the timer. Is preferably transmitted.
Example (4): FIGS. 12 and 5
This embodiment (4) shows a modification of the above embodiment (1). That is, as can be seen by comparing FIG. 12 with FIG. 6, regarding the regular ARP request RQ2 from the unauthorized terminal 12, there is no VLAN tag in the frame of FIG. 6, but in the embodiment of FIG. Added to support the VLAN environment network shown in Figure 2.

  That is, in the above embodiment (1), the VLAN tag is analyzed in step S402 shown in FIG. 5 and the VLAN tag is assigned in step S451. When the request RQ2 is received (step S13 in FIG. 4 (2)), the VLAN tag analysis unit 211 in the network interface unit 21 determines the presence / absence of VLAN tag information in the received packet. The VLAN tag information is analyzed (step S402), the ARP processing unit 22 is activated as input information obtained by adding the VLAN tag information to the above address information, and the ARP receiving unit 221 determines whether or not it is an ARP message ( Step S411), the source / destination address information (MAC address, IP address) is extracted.

  The ARP processing unit 22 determined as an ARP message by the ARP reception unit 221 activates the unauthorized connection determination unit 23 using the extracted VLAN tag information and address information as input information. The activated unauthorized connection determination unit 23 determines whether the combination of the input VLAN tag information and the input address information exists in the address information database unit 224 registered in advance by the network administrator by the fraud detection unit 231 (Step S1). S422).

  With this determination process, when the set of input VLAN tag information and input address information exists in the address information database unit 24, the sequence is as shown in FIG. 4 (1). The interference control unit 251 in the interference processing unit 25 is activated.

  In the disturbance control unit 251, in step S431, the source IP address information area D1102 and the destination IP address information area D1104 are the same, so it is determined that the network is connected, and the VLAN tag information and the address information of the unauthorized terminal 12 are obtained. As the input information, a disturbing ARP reply and a disturbing ARP request transmission request are made to the ARP transmitting unit 222 in the ARP processing unit 22. The ARP transmitter 222 generates an ARP message based on the input information as described above (step S441). The ARP processing unit 22 activates the network interface unit 21 by inputting the generated message and VLAN tag information.

  In the network interface unit 21, the VLAN tag assigning unit 212 sets the input VLAN tag information as the VLAN tag information of the transmission message in the VLAN environment, and the disturbing ARP reply (RP1, RP2) and the disturbing ARP request shown in FIG. (RQ3, RQ5) is transmitted as an ARP message (step S452).

Here, by inserting and transmitting the same VLAN tag information as the VLAN tag information at the time of reception, even if the VLAN tag is “A”, for example, even in a VLAN environment as shown in FIG. A disturbing ARP message is reliably delivered to the unauthorized terminal 12 in the segment “A” and can be blocked.
Example (5): FIGS. 13 and 5
This embodiment (5) shows a modification of the above embodiment (2), and in addition to the address information as input information, as in the relationship between the above embodiment (4) and the embodiment (1). VLAN tag information is used.

  That is, as shown in FIG. 13 as a regular ARP request RQ13 from the unauthorized terminal 12 shown in FIG. 7 (2), VLAN tag information is added in the packet. As in the example (4), in addition to the address information, the VLAN tag information is also used for determining an illegal address (step S422 in FIG. 5). In the case of FIG. 7 (2), an illegal address is detected. move on. At this time, since the case of the embodiment (2) is a case where communication between terminals is performed, also in this embodiment (5), the process similarly proceeds to step S433, and the transmission request of the disturbing ARP request RQ13 shown in FIG. Do.

Then, when the ARP message is generated in step S441, the VLAN tag adding unit 212 adds the VLAN tag information set in the regular ARP request RQ13 received from the unauthorized terminal 12 (step S451), thereby preventing the disturbing ARP request. The RQ 13 is transmitted and the unauthorized terminal 12 placed under the VLAN environment can reliably receive the disturbing ARP message and be able to interfere.
Example (6): FIGS. 14 and 10
This embodiment (6) shows a modification of the above embodiment (3). That is, as shown in FIG. 14, the regular ARP requests RQ21 and RQ22 from the network unauthorized connection prevention device 20 are in a form in which VLAN tag information is added to the packet shown in FIG. In the flowchart shown in FIG. 10, when the ARP processing unit 22 generates an ARP message (step S511), VLAN tag information is added together with the VLAN tag information in addition to the address information (step S521), and a search ARP request is made. (Step S522).

  Therefore, at the terminal that has received such a search ARP request, as shown in FIG. 14, a frame with the VLAN tag information set in the normal ARP request added as is is returned as the ARP replies RP21 and RP22 of the normal ARP request. Therefore, as explained in FIG. 9, the authorized ARP reply RP22 from the unauthorized terminal 12 is detected illegally in the unauthorized network connection preventing apparatus 20 (step S78).

  The ARP request in the present invention does not simply indicate one of the ARP frames that is a communication frame based on the protocol specification (RFC826) for obtaining the physical address (or link layer address) of the communication partner whose IP address is known. In light of the gist of the present invention, it can be configured as any communication frame having the purpose and function.

(Appendix 1)
A first step of determining whether or not the personal information of the terminal included in the ARP request received via the LAN from the terminal has been registered;
A second step of transmitting a jamming message indicating that the terminal's personal information is duplicated when the terminal is determined to be unregistered in the first step;
A method for preventing unauthorized network connection, comprising:
(Appendix 2)
In Appendix 1,
A network unauthorized connection prevention method, wherein the ARP request is an ARP request transmitted at the time of network connection.
(Appendix 3)
In Appendix 1,
A network unauthorized connection prevention method, wherein the ARP request is an ARP request when the unauthorized terminal requests private information from another terminal.
(Appendix 4)
In Appendix 1,
2. The network unauthorized connection prevention method according to claim 2, wherein the second step includes a step of repeatedly transmitting the jamming message a predetermined number of times at predetermined time intervals.
(Appendix 5)
In Appendix 1,
The jamming message is composed of at least one of a jamming reply and a jamming request in which the personal information of the illegal terminal is set in the transmission source address so that the illegal terminal is duplicated in the personal information. A method for preventing unauthorized network connection.
(Appendix 6)
In Appendix 1,
A network unauthorized connection prevention method, wherein the personal information is a MAC address or an IP address.
(Appendix 7)
A first step of sequentially sending an ARP request to each registered terminal;
From the ARP reply returned in response to the ARP request, a second step of determining whether the personal information of the terminal has been registered,
When it is determined that the terminal is not registered in the second step, a third step of transmitting a jamming message indicating that the terminal is regarded as an unauthorized terminal and the unique information of the terminal is duplicated; and
A method for preventing unauthorized network connection, comprising:
(Appendix 8)
In any one of appendices 1 to 7,
The network unauthorized connection prevention method, wherein the personal information includes an address and a VLAN tag as a determination target, and the interference message includes the address and the VLAN tag.
(Appendix 9)
A first means for determining whether the personal information of the terminal included in the ARP request received via the LAN from the terminal is registered;
When it is determined that the first means is not registered, the second means that the terminal is regarded as an unauthorized terminal and transmits a jamming message indicating that the unique information of the terminal exists,
An apparatus for preventing unauthorized connection of a network, comprising:
(Appendix 10)
In Appendix 9,
An apparatus for preventing unauthorized network connection, wherein the ARP request is an ARP request transmitted at the time of network connection.
(Appendix 11)
In Appendix 9,
An apparatus for preventing unauthorized connection of a network, wherein the ARP request is an ARP request when the unauthorized terminal requests private information from another terminal.
(Appendix 12)
In Appendix 9,
An apparatus for preventing unauthorized connection of a network, wherein the second means includes means for repeatedly transmitting the jamming message a predetermined number of times at regular time intervals.
(Appendix 13)
In Appendix 9,
The jamming message is composed of at least one of a jamming reply and a jamming request in which the personal information of the illegal terminal is set in the transmission source address so that the illegal terminal is duplicated in the personal information. An apparatus for preventing unauthorized connection of network.
(Appendix 14)
In Appendix 9,
An apparatus for preventing unauthorized connection of a network, wherein the unique information is a MAC address or an IP address.
(Appendix 15)
A first means for sequentially sending an ARP request to each registered terminal;
From the ARP reply returned in response to the ARP request, a second means for determining whether or not the personal information of the terminal has been registered;
When it is determined that the second means is unregistered, the third means for transmitting a jamming message indicating that the terminal is regarded as an unauthorized terminal and that the unique information of the terminal is duplicated, and
An apparatus for preventing unauthorized connection of a network, comprising:
(Appendix 16)
In any one of appendices 9 to 15,
An apparatus for preventing unauthorized connection of a network, wherein the personal information includes an address and a VLAN tag as a determination target, and the interference message includes the address and the VLAN tag.

It is the figure which showed the system configuration example used for the network unauthorized connection prevention method and apparatus which concern on this invention. 1 is a system configuration diagram when a network unauthorized connection prevention method and apparatus according to the present invention are used in a VLAN environment. FIG. It is the block diagram which showed the structural example of the apparatus which implement | achieves the network unauthorized connection prevention method which concerns on this invention. FIG. 4 is a sequence diagram showing an operation of the embodiment (1) of the network unauthorized connection preventing apparatus according to the present invention shown in FIG. FIG. 4 is a flowchart showing an example of a reception operation of the network unauthorized connection prevention apparatus according to the present invention shown in FIG. FIG. 5 is a format diagram showing a schematic frame (when there is no VLAN tag) of the ARP protocol used in the sequence example shown in FIG. FIG. 4 is a sequence diagram showing an operation of the embodiment (2) of the network unauthorized connection preventing apparatus according to the present invention shown in FIG. FIG. 8 is a format diagram showing a schematic frame (when there is no VLAN tag) of the ARP protocol used in the sequence example shown in FIG. FIG. 4 is a sequence diagram showing the operation of the embodiment (3) of the unauthorized network connection preventing apparatus according to the present invention shown in FIG. FIG. 4 is a flowchart showing an example of transmission operation of the unauthorized network connection preventing apparatus according to the present invention shown in FIG. FIG. 10 is a format diagram showing a schematic frame (when there is no VLAN tag) of the ARP protocol used in the sequence example shown in FIG. FIG. 5 is a format diagram showing a schematic frame (when a VLAN tag is attached) of the ARP protocol used as the embodiment (4) in the sequence example shown in FIG. FIG. 8 is a format diagram showing a schematic frame (when a VLAN tag is attached) of the ARP protocol used as the embodiment (5) in the sequence example shown in FIG. FIG. 10 is a format diagram showing a schematic frame (when a VLAN tag is attached) of the ARP protocol used as the embodiment (6) in the sequence example shown in FIG.

Explanation of symbols

10, 11 Regular terminal
12 Unauthorized terminal
20 Network unauthorized connection prevention device
30 hub
21 Network interface section
211 VLAN tag analyzer
212 VLAN tag unnecessary part
22 ARP processing section
221 ARP receiver
222 ARP transmitter
23 Unauthorized connection determination section
231 Fraud detector
24 Address information database section
25 Interference handling section
100 LAN
110 VLAN
251 Interference controller
252 Receive address buffer
253 Timer controller
26 Search request processing section
261 Search Control Unit
262 Timer processing section
RP (RP1, RP11, RP12) ARP reply
RQ (RQ1, RQ2, RQ3, RQ4, RQ11, RQ12) ARP request In the figure, the same symbols indicate the same or corresponding parts.

Claims (5)

A first step of determining specific information of the terminal is whether the already registered included in the ARP request received via a LAN from the terminal,
When it is determined that the terminal is not registered in the first step, the terminal is regarded as an unauthorized terminal, and an interfering ARP reply in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address; A second step of transmitting a disturbing ARP request in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address ;
A method for preventing unauthorized network connection, comprising: In claim 1,
A network unauthorized connection prevention method , wherein a VLAN tag is assigned to the disturbing ARP reply and the disturbing ARP request . A first means for determining whether the specific information of the terminal contained in the ARP request received is already registered via the LAN from the terminal,
When it is determined as unregistered by the first means, the terminal is regarded as an unauthorized terminal, a disturbing ARP reply in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address; A second means for transmitting a disturbing ARP request in which an address of a terminal regarded as an unauthorized terminal is set as a source address and a destination address ;
An apparatus for preventing unauthorized connection of a network, comprising: In claim 3,
A network unauthorized connection prevention apparatus , wherein a VLAN tag is assigned to the disturbing ARP reply and the disturbing ARP request . A first means for sequentially sending an ARP request to each registered terminal;
From the ARP reply came back in response to the ARP request, and a second means for determining whether the specific information of the terminal is already registered,
When it is determined as unregistered by the second means, the terminal is regarded as an unauthorized terminal, and the disturbing ARP reply in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address; A third means for transmitting a disturbing ARP request in which the address of the terminal regarded as the unauthorized terminal is set as a source address and a destination address ;
An apparatus for preventing unauthorized connection of a network, comprising:

Images